I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my servers.
I supply a license that allows the user to use the software on up to three devices. To enforce this, I store a unique device identifier in my database whenever a license is used to activate the product.
I'd argue that the unique device identifier does not allow me to trace the license to any specific individual, only to a device.
Would it help if I encrypted the device identifier in my database?