Card numbers never reach our servers: entry happens in a field hosted by our payment provider. We keep only what is needed to display and tell your cards apart, namely the network, the last four digits, the expiry date, the issuing country and a technical identifier from the provider used to spot a card saved twice. Neither the full number nor the security code reaches us.
Removing a card never turns automatic top-up off. If you remove the one that served as the default, another is promoted in its place, with priority given to those that can fund a top-up. And if no usable card would be left, the removal is refused rather than silent: the screen shows « Turn off automatic top-up before removing your last card. »
A SEPA Direct Debit is a payment method, but it does not stand in for a card: it settles in 2 to 5 business days, so after the campaigns it was meant to protect have stopped, and it cannot fund automatic top-up. Keeping a SEPA mandate therefore does not let you remove your last card while top-up is armed.