A short, complete list. If something is not on it, this site does not have it.
Stored against every order
The order code, the plan and term, the price in dollars, the coin and network you chose, the deposit address and amount, the swap provider's reference, and the settlement transaction id once the swap completes. Also the email address you gave for delivery.
Stored about the request
The IP address the order came from, the browser string, the country code Cloudflare supplies, and the referring page if there was one. This is kept because chasing a payment that went wrong means matching a person to an order without asking them to prove who they are, and because a pattern of fraudulent orders is only visible if the requests are attributable.
If that trade is not one you want to make, this is not the right desk for it. Some sites in this space keep less. That is a legitimate preference and you should act on it rather than take a policy page's word for anything.
Never collected
No account, because there is no login. No password. No card number, at any point, because you never give this site a card. No name, no postal address, no phone number. No analytics script, no advertising pixel, no social widget, no cookie for visitors at all.
Who else sees it
The swap provider receives what it needs to execute the exchange: the coins involved, the amounts, and the addresses. It does not receive your email. Nobody else receives anything. Nothing is sold, shared with advertisers, or handed to a data broker.
How long
Order records are kept indefinitely, because an order code has to keep resolving when somebody returns months later asking about a purchase they made. Web server logs rotate out on a fixed schedule and are not joined to order records.
Getting it removed
Email from the address on an order and ask. Deletion is done by hand and is final, including the ability to help with that order afterwards.