Privacy Policy
Last updated: August 21, 2026
This notice describes how Top Floor Music Group (“we,” “us”) collects and uses personal information on music.xaviertopfloor.com, the mailing-list form on that site, and when the site sends visitors to the linked store at www.xaviertopfloor.com. It is written from the production implementation: Osano consent, Google Tag Manager, Google Analytics, Google Consent Mode, Meta Pixel, PostHog, Vercel hosting/analytics, Brevo email, and Shopify commerce.
Contact: contact@xaviertopfloor.com. Operator location: Los Angeles, California, United States. This policy is a factual description of the public website. Whether a particular privacy law applies depends on our organization, revenue, and the visitor’s location.
1. Who is responsible
For this music website, Top Floor Music Group is the operator and, where GDPR/UK GDPR applies, the controller of personal data collected through the site and mailing list. Purchases on the Shopify store are also processed by Shopify and any payment provider used at checkout; that store has its own checkout and may display additional notices.
2. Information we collect
Website visitors
- Technical data: IP address, browser, device, approximate location derived from IP, referral URL, and pages viewed.
- Consent records: cookie-category choices, Do Not Sell or Share opt-out, and Global Privacy Control.
- Usage events after consent: analytics page views and, if advertising is allowed, advertising identifiers.
Mailing list
If you submit the form, we collect your name, email address, and the fact that you checked the consent box. The form states the purpose: early drops, unreleased records, show alerts, and merchandise links.
Store and streaming clicks
Links to Spotify, Apple Music, YouTube, Audiomack, Amazon Music, Tidal, Pandora, and the Shopify store send you to those providers. Those providers collect data under their own terms. If advertising tags are allowed, a click may also generate a Meta or Google event such as Subscribe or ViewContent.
3. Purposes and legal bases
If European or UK privacy law applies, we rely on the following:
- Consent: analytics, advertising/personalization tags, and mailing-list marketing.
- Contract / requested steps: sending you to a purchase or streaming destination you chose.
- Legitimate interests: running a secure website, remembering essential consent choices, and diagnosing outages.
- Legal obligation: keeping records needed to respond to rights requests or lawful process.
If those laws do not apply, we still do not load optional analytics or advertising cookies until the matching category is allowed.
4. Cookies, SDKs, and similar technologies
This section is the Cookie Policy for the site. Optional technologies stay off until Osano reports that category as allowed. Reject All must leave analytics, targeted advertising, and personalization denied.
| Name / technology | Provider | Category | Purpose | Retention |
|---|---|---|---|---|
| xtf_consent | Top Floor Music Group | Essential | Stores this site’s consent choice so Google Consent Mode can be applied correctly. | 13 months |
| xtf_dns | Top Floor Music Group | Essential | Stores a Do Not Sell or Share opt-out for this browser. | 13 months |
| xtf_gpc | Top Floor Music Group | Essential | Records that a Global Privacy Control signal was received. | 13 months |
| osano / Osano CMP cookies | Osano | Essential | Remembers cookie-banner choices and powers the consent interface. | Up to 12 months |
| Google Tag Manager (GTM-T9MV7XL6) | Essential loader / optional tags | Loads tagged scripts. Optional tags fire only after the matching consent category is allowed. | Session / tag-dependent | |
| _ga, _ga_WQBH9HF9ZQ, _gid | Google Analytics 4 | Analytics | Measures site usage such as pages viewed and session counts. Not set unless Analytics is allowed. | Up to 13 months / 24 hours |
| Google Consent Mode signals | Analytics / Advertising | ad_storage, analytics_storage, ad_user_data, ad_personalization, and personalization_storage start denied and update from Osano categories. | Until the consent choice changes | |
| _fbp, _fbc | Meta Platforms | Targeted advertising | Meta Pixel identifiers used for advertising measurement and retargeting. Not set unless marketing/advertising is allowed. | Up to 3 months |
| PostHog identifiers (ph_ / phc_) | PostHog | Analytics | Product analytics. Session recording is disabled in the site loader. Not set unless Analytics is allowed. | Up to 12 months |
| Vercel Analytics / Speed Insights | Vercel | Analytics | Hosting-platform performance and aggregated traffic measurement, gated by the same analytics consent flag. | Vendor default |
| Shopify cookies (_shopify_*, cart) | Shopify | Commerce | Set on www.xaviertopfloor.com during browsing, cart, and checkout. That store’s privacy terms also apply. | Vendor / checkout dependent |
| Brevo (email service) | Brevo | Marketing communications | Stores mailing-list contact details after an explicit signup. Not a website cookie on this domain. | Until you unsubscribe or we delete the record |
5. Recipients and international transfers
We use the following processors or destinations. Several are in the United States:
- Osano — consent management
- Google — Tag Manager, Analytics, Consent Mode
- Meta Platforms — Pixel, if advertising is allowed
- PostHog — product analytics, if analytics is allowed
- Vercel — hosting, delivery, and optional analytics
- Brevo — mailing-list storage and sending
- Shopify — store, cart, and checkout on www.xaviertopfloor.com
- Streaming platforms and URL redirect services when you click a listen or store link
Where GDPR/UK GDPR applies, transfers outside the UK/EEA rely on the vendor’s applicable transfer mechanism, such as Standard Contractual Clauses, plus the consent or necessity basis for the activity.
6. Retention
- Essential consent cookies: up to 13 months, or until you clear site data.
- Analytics and advertising cookies: only while that category remains allowed; they are expired on withdrawal or Reject All.
- Mailing-list records: until you unsubscribe, your address bounces, or you ask us to delete them.
- Server logs: typically a short operational period unless needed for security or legal claims.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export personal information, to restrict or object to certain processing, and to withdraw consent. Withdrawal does not affect processing that already happened. To use these rights, email contact@xaviertopfloor.com.
If GDPR/UK GDPR applies, you may also complain to your local data-protection authority, including the ICO in the United Kingdom. You can withdraw cookie consent at any time through Cookie Preferences or Reject All. Withdrawing analytics or advertising consent expires those optional first-party cookies and opts the relevant SDKs out in this browser.
8. California privacy choices
We do not sell personal information for money. The site does include targeted-advertising tools (including Meta Pixel and Google advertising/consent fields). Under California law, disclosing personal information for cross-context behavioral advertising can be “sharing,” which is separate from a “sale.”
If California’s consumer privacy laws apply to this business, you have the right to know, delete, correct, and opt out of sale or sharing, and not to be discriminated against for exercising those rights. Use the control below. We also honor a browser Global Privacy Control (GPC / Sec-GPC: 1) signal as an opt-out of sale and sharing for this browser.
This control opts you out of the sale or sharing of personal information for cross-context behavioral advertising on this website. It does not require an account. The choice is stored on this device and applied to Google advertising signals, Meta Pixel, and similar marketing tags.
You may also email contact@xaviertopfloor.com with the subject “California privacy request.” We will need enough information to identify the request and the browser or email address it concerns.
9. Children
This website is a music and merchandise site for a general audience. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child submitted information, contact us and we will delete it.
10. Linked commerce
The digital album Quiet Conversations In The Smoking Lounge is sold on Shopify at a displayed minimum of $5.13, with additional listed price options. Checkout, payment, shipping/tax, and storefront cookies are handled on www.xaviertopfloor.com. Shopify may set identifiers such as cart and session cookies, and may process order details, payment status, and device information as described in Shopify’s buyer notices.
11. Email
We send occasional artist and merchandise updates only after you submit the form with the consent box checked. Every marketing email will identify Top Floor Music Group, include a valid physical postal address, and include an unsubscribe method that we honor. You can unsubscribe at any time.
12. Changes
We will update this notice when vendors, cookies, or purposes change. The “Last updated” date at the top shows the current version.