Keeping _SESSION vars over two different HTTPS websites (cross-origin)

Question

I am selling web PHP code on CodeCanyon. When a client clicks on my app, my app opens in a frame, on their website.

My app is hosted on HTTPS (xxx.net), and their ser