Privacy & Security
How RewardLion protects data across our applications, RewardLion World, and the Command Center.
This page supersedes the Privacy & Security page dated March 15, 2026.
1. Our Approach
RewardLion is operated by Global Digital Business Solutions LLC. Our Platform handles business data, customer information, and marketing analytics. We protect it through isolation, least privilege, encryption, and human approval of changes.
2. Isolation Between Applications
Each RewardLion application runs separately: its own code repository, its own hosting, its own database, and its own credentials. One application cannot read another application's data or use another application's credentials. Where applications need to share information, they do so through specific, logged connections.
3. Least Privilege
People and systems receive only the access they need for their role.
- Staff and leadership areas are reached only through the Certified AI-Powered Solution Specialist (CAPSS™) login.
- In RewardLion World, each signed-in person sees only the Microsoft Teams teams and channels they already belong to.
- The content of Teams channel messages is shown only to the account owner with Master access. Other staff see presence and activity levels, not message content.
- ZICO™ reads finance summaries from our CFO application through a read-only, revocable, logged connection. ZICO cannot move money or approve anything.
4. Encryption
Data moving between your device and our services is encrypted in transit using TLS. Data stored by our hosting and database providers is encrypted at rest. Refresh tokens for optional Microsoft connections are additionally encrypted with AES-GCM before they are stored on our servers.
5. Sign-In and Connections
- CAPSS™ login. Staff sign in once through the CAPSS™ login, which issues a secure sign-in cookie used across RewardLion staff applications.
- Microsoft connection. Optional, delegated, and read-only. It uses the person's own Microsoft permissions, so RewardLion World can never show that person more than Microsoft already allows them to see. It can be disconnected at any time.
- Public showcase. The public showcase at admin.rewardlion.com requires no account and stores only two settings on the visitor's own device.
6. Voice and Audio
Wake-word ("Hey ZICO") and clap detection run on the device, inside the browser. Our servers receive only the name of the event, never audio or words. Navigation logs record the decision ZICO made, never what was said. Live voice conversation, where enabled, is processed by our voice AI provider, ElevenLabs, which stores conversation transcripts under its own terms.
No camera is used anywhere in RewardLion World or the Command Center.
7. AI Processing
AI features process your data to deliver your own services. Your data is kept separate from other clients' data and is not used to train AI models that serve other clients. AI Agents identify themselves as AI when they speak with consumers. Actions that are public-facing, contractual, or financial require human approval.
8. How Changes Reach Production
Changes to our applications are reviewed and released through an approval process that requires a person to approve each release. Automated systems cannot release changes on their own.
9. Hosting Providers
Our applications are hosted with established cloud infrastructure providers that maintain their own independent security programs and certifications. We choose providers that encrypt data at rest and in transit. The third-party platform behind RewardLion CRM maintains a SOC 2 Type II report, which includes independent audits of its security controls.
10. Health Information
RewardLion provides sales and marketing services to clinics and other businesses. RewardLion is not HIPAA compliant and is not a HIPAA business associate. RewardLion does not accept, store, or process protected health information (PHI), and does not sign Business Associate Agreements.
- Don't send PHI. Clients must not send PHI through any RewardLion service, form, CRM, integration, upload, or message.
- Contact and scheduling details only. Forms and campaigns we build collect contact and scheduling details only. They do not ask for medical history, symptoms, diagnoses, or treatment details.
- If PHI reaches us by mistake, we delete it and notify the client.
11. Incident Response
If we discover a security incident affecting your personal information, we will contain it, investigate it, fix it, and notify affected users without undue delay and within the time required by applicable law. Notices will describe what happened, what data was affected, and what we are doing about it.
To report a security concern, email info@rewardlion.com with the subject line "Security Report."
12. Contact
Global Digital Business Solutions LLC (RewardLion)
333 Las Olas Way, Suite 1, Fort Lauderdale, FL 33301
info@rewardlion.com | +1 (800) 876-8984