where does $data come from in hook_tokens?
The $data is whatever is originally passed to the token_replace function by the process that's doing the token replacement.

The var itself is:


  An array of keyed objects. For simple replacement scenarios 'node', 'user', and others are common keys, with an accompanying node or user object being the value. Some token types, like 'site', do not require any explicit information from $data and can be replaced even if it is empty.


It's essentially just an array that's used to pass extra context to the token replacement, and it can contain anything at all. 

For example if you were writing a module that introduced a custom entity type, you could use this feature to pass an instance of that type in to be used in your own tokens.

In your specific case, it's presumably the Webform module that prepares that data array, so that would be where to look if something's missing. Or it could be a submodule if that's what you've used to provide the payment fields themselves.