This is something that is not recommended, as you would require going through the pci compliance:
www.pcisecuritystandards.org/
This is a pretty expensive process. I would recommend using the no payment gateway option and then when the product is assembled, get the credit card information over the phone instead of storing it in a database.
The email is sent to both I believe, so you wouldn't need to edit it using Universal Email.