They shouldn't have access to card number and CVV either way because usually they are not PCI-DSS certified. Stripe handles that in an iframe (requirement of PCI). CVV cannot be stored at all even by Stripe.