Before a user can create an order, he collects items in his cart. During the checkout, this cart gets completed with address data. After submitting the order, the order gets created as a copy of the cart. Besides the item information, address data of the customer as saved. The amount of data depends on the components configuration.
Address data exists in three places: cart, order and the Joomla! user object. While this can't be changed for the cart and the order, you can configure that the user object is not used for storing data in the components options.
For some payment methods, external services are used. Event Gallery does not store direct payment data. Instead a generated token is used to identify the transaction created by the external payment provider.
The back end of Event Gallery allows clearing carts which are older than 30 days by clicking a simple link.