Problem is if you use PayPal as payments, as it's a requirement
Also for any purchases by industry standard you should keep the information private and secure (and not delete it), as for you as a "business" are accepting payments. Let me try to explain.
Let's say the following scenario. I'm selling Cookies. Now if you want to pay me directly you can hand me the money straight and I won't need your name. BUT you won't either have any warranty or any proof of purchase. So if you come to me or anyone saying I want my money back I can just say "It never happened".
Now let's say this is online. For you to pay with your digital presence for my cookies, you will need to use your card.
The card needs to be connected somehow, so how do you prove that you are you to the bank, well your name your address etc.
Now you don't seem to have the resources and not many in the world have this to run their own card processing (as strict banking rules etc applies) So I as a seller turn to Paypal, or Stripe or Visa, Mastercard God knows they all work together to make an online experience for users.
Now I'm working with Paypal in this scenario and I tell them that they get certain % of the sale for each time I do a sale. (that's how they make money), so they agree and I get access to their service.
Once I have this I can go to you and say hey, you can buy my cookie and you can use your online card presence to pay me just use PayPal.
Now you get to PayPal to pay, and by International Law, they have to get certain user information to match.
Name, Address is a must. BUT sometimes they can ask for other forms of ID. This is used for PayPal to process your card and make sure you are you.
The API that Paypal provides will reply back once you have made your purchase, and it will give all that information to you. The system picks it up and stores it.
If a user now says "I didn't get my cookies" well I can't deny it if it's paid for to me. By deleting their user data, YOU also in a certain way "scam" them as they have no way of proving things were paid as a proof of purchase.
So why would you need to remove the data? or hide it. Just enforce proper strict AdminCP rules, who has access to what and you be fine. Remeber to use SSL and secure your database to the best of your knowledge or get a person that knows how to secure it.
TLDR; Don't delete customers data, make sure it's safe. If users do not pay for anything or are no longer your customers then you could delete their data, but until then you can't sadly.