the only thing the app does is start transactions and check with the server if they’re paid
Yeah, but the whole PCI DSS thing means that the app must still be secured. That doesn’t necessarily mean that it has to be tied to Google Play, but explain it to them.
A lesser standard still applies if it either embeds or redirects to a payment page. Again, shouldn’t mean shit, but still.