Paypal does have a future payments token capability [1]. The user must explicitly authorize the merchant the ability to use the token in order to use it for future transactions. We save the email for reference, but we never save the password.

[1] https://developer.paypal.com/docs/integration/mobile/make-fu...