You need to be on HTTPS to accept credit card data at as bare minimum, and should be PCI-DSS certified to retain any credit card data.

For further information I would suggest speaking with a representative of your merchant account (or, credit card processor).