Exchange has my CC number and the 'card holder' (though I never put my name there, lol). A non-business card is probably the most easy way to identify someone globally.

If someone comes to exchange - they could identify me (and they can just tap their server to listen to email which do have all the transaction info, including CC# in the plaintext, lol).

To establish a correlation between my wallet and Mullvad account someone needs to find that transaction in Mullvad customer data. Which - they claim they don't have.

So yes, someone can identity what I bought services from Mullvad and... nothing more?