They bought:

Send a pm to you with username/email

once you receive the pm, you add the license

username/email with blank hwid & password

the license has been added, the guy is mailed by the server

with this details : username/password & download instructions

once he downloaded he simply login with your application

your application will send the request to me, then i'll check if there's no hwid i'll add it but i won't grant the login.

I will return and parse that I added his hwid
then you'll say please login again,
he will login again then the normal procedure will be done

you see?