The split is simple enough. A payment provider carries the part that would be dangerous for you to do yourself. You carry what happens between you and your customer.
What the provider takes on
The provider handles the card number. Your customer types it into a form the provider controls, the provider stores it, and your app gets back a reference it can use to charge or refund. The provider also deals with the banks and card networks, and pays the money out to your account on a schedule.
Holding card numbers yourself is where the serious risk lives. The card industry has its own security standard, called PCI DSS, and it applies to businesses that accept cards. Using your provider's own payment form generally cuts down what you have to do under it by a long way, but you'll usually still have some paperwork, often a short yearly form. What you need depends on how your app takes payment, so ask your payment provider.
Card numbers don't belong in your app, your database, your email, a text or a sticky note. That includes phone orders. If customers read you their card over the phone, ask your provider for the right way to enter it.
What stays with you
Refunds are yours to decide. The provider moves the money, but the policy, the judgment call and the awkward conversation are all yours. Put your policy somewhere customers can find it. Ask whether you get the processing fee back on a refund, because this varies.
Disputes come next. A customer can go to their bank and challenge a charge, and the money can be pulled from your account while it's decided. You'll get a deadline to send your side: what was sold, when it was delivered, what was said. Miss the deadline and you'll usually lose. There may also be a fee, so ask about that too.
Some disputes start with a customer who just doesn't recognize the charge. Make sure the name on their statement is one they'd know, and send a clear receipt.
Then there's fraud. If someone pays online with a stolen card, the cost usually ends up with the business, and you may have shipped the goods as well. Find out what fraud tools your provider offers and turn on the ones that fit. A big first order from a stranger, in a hurry, deserves a second look.
Your standing with the provider is yours to look after too. Providers don't serve every kind of business, and they can hold payouts or close accounts if disputes pile up or something looks risky. Read their terms before you build around them. A freeze on your money is a bad way to learn what they say.
If you save cards or bill on a schedule, customers need to clearly agree to it, and cancelling should be easy. Rules on this differ from place to place, so get advice if it's a big part of your business. Sales tax is a question for your accountant.
Where apps slip up
A payment is a conversation between your app and the provider, and that's where a fast-built app tends to go wrong. The provider tells your app the customer paid, and if the app misses that message, a paid order looks unpaid. A customer taps the button twice and gets charged twice. A renewal fails and nobody finds out.
So before launch, run a small real charge from start to finish, then refund it. After launch, compare the provider's list of payments with your app's orders on a regular basis. Any mismatch is a bug worth chasing, even a small one. Your provider's secret key should also stay out of anything a visitor's browser can see. If you're not sure about that, ask whoever built the app.
A lot of this depends on your provider, your state and what you sell, and none of it is legal or financial advice, so don't take a blog post's word for it. Your provider's support team answers these questions all day.
