I've heard that online merchants can only keep credit card information for set periods of time. Is this true? Amazon's express checkout feature saves credit card info, so does apple's app store. What are the legalities behind the scenes? Legal experts?
You have two issues:
1) What you're talking about is called PCI DSS. It is a set of rules you must adhere to that is set forth by the payment card industry. You must be PCI compliant if you accept credit cards on your website. Definitely read up on this if you accept or will accept credit card payments on your website.
2) State and federal laws supersede PCI DSS and varies by state. You'll need to do some research to see how this affects your website.