They're a new company, essentially set up specifically to cater to the online vape market. They do not have any track record as to the quality of their protection of data. They might be fine, they might be lazy and clumsy. Then again, even companies with solid IT divisions tight security procedures and strong encryption have been hacked, so no guarantee whether dealing with Bluceheck, Yahoo, or Citibank. Lots of confidential personal information has already been hacked and is floating around out there that can come back and hurt you.
Personally, I'd prefer a vendor use an age verification service with a history and track record at doing so with strong security measures such as Veratad, but even that is no 100% guarantee. Nature of the current world we live in and online transactions.