Is it legal for a business to store and use my payment information in a way that I can't edit, remove, or otherwise control?

I recently moved from a townhouse where I used Waste Management for my trash and recycling pick up. The apartment I moved into takes care of trash so last month I canceled the service, got a phone confirmation, and even took the extra step of removing my payment information from the website.
What I see in the online portal is:

All services are not showing and section is greyed out, autopay shows enroll option showing I unenrolled, and is grayed out to reflect no services available for autopay. And further, probably more importantly here, in the manage payment methods section:

Clearly no payment method saved.
Both of these views on the website have shown me this for weeks. Now in this case I’m assuming it’s a software bug. I’ve already cleared it up with Waste Management (customer service rep looked into it, said it showed me still in auto pay on their system, took it out and refunded the extra charge that let me find out this was happening. Another set of bugs in that even if I was enrolled in autopay, if there are no services scheduled, it shouldn’t be billed anyway, but less relevant here). Hopefully not too much background… I assumed when I deleted my saved credit card numbers they were no longer available to Waste Management in anyway, yet clearly they were saved in another capacity to continually be used like this.

Is it legal for a business to store and use my payment information in a way that I can’t edit, remove, or otherwise control?