Active users can access Costlocker, log time and be assigned to projects. You can manually deactivate a user which will remove those powers, but their data will stay. You can also re-activate them at any point again.
You don't pay for deactivated users and you can have any number of them.
Read more about this in our documentation.

If you deactivate any users during the period of subscription that is already prepaid, the ratio for the unused period will then be transferred to a credit, which will automatically reduce the next invoice.

All payment details are stored and secured by Stripe.

No, a credit card is only required when you are transitioning to the paid period.