Horrible experience with Iwantmyname.com

Yesterday I moved to iwantmyname.com and wanted to buy a couple of domains from them. After I bought 2 I wanted to buy the 3rd a .io domain and in the meanwhile I had to transfer some funds from my bank and ofc the transaction with iwantmyname.com failed. Ok that is fine, I got an email saying that the transaction failed and I looked at my dashboard and after that moved to other busy things and forgot about it. Meanwhile the strategy with the .io domain changed last night and I did not need that domain anymore. Everything ok until now ... but I get an email today saying I have bought the .io domain and sending me the invoice. They have charged my credit card. First I didn't even knew that they were storing my credit card info...why the hell would you do that anyway? As an experienced developer and a security freak I got really mad. I saw after on the dashboard that you can select to erase your credentials. Again I really do not understand why are they doing that?From what I know they could be storing them plain text or even if they are encrypting them I do not trust it...and the problem is not that I do not trust it, but that the site is really vulnerable and insecure...if someone hacks their database I bet they crack all the data because I know how hard is to secure sensitive data. This is the first issue with them...but the second and most important issue...why the hell wasn't I informed about being charged? I do not recall giving them permission for recurring payment. Iwantmyname.com should put their engineers to work because their security design is really poor. It is a recurring transaction for my bought domains because I know that my xxx domain will expire in 1 year and I am ok to bill me when it expires after I purchase it, but when a transaction fails why the hell would you want to retry billing? That is low low programming. I read a lot of good feedback on HN about them...has anyone had other bad experiences with them?