The goal of GDPR is about protecting personal information (PI) as much as possible. The interaction of a specific user with your application are pretty sure such PI. 

If you really need to log this information you should inform your user about this process, i.e. the purpose of the data collection, how long the information gets stored and who gets access to the data. And you and whoever you sell the application to should never use the data for any other purpose as agreed to by the user. And of course you need to properly protect the information against misuse, i.e. use outside of the specified purpose. This specifically but not only includes if someone hacks into your application or server and steals this data.

Since use of the data is limited and protection (and fines) can be costly, it might be easier to not store these information in the first place. In alternative is to at least pseudonymize the PI as much as possible, i.e. in a way that the logged data are still usable for you but that no association to a specific user can be done even when having all the logged data. Since it is not really clear what you use these logs for no recommendations can be done for a specific process of such pseudonymization.