Cookie Policy
Cookie Policy
This policy lists the cookies the Helmsley Group website and client portal set, what each is for and how long it lasts. For how we handle personal data more generally, see our Privacy Policy.
What cookies are
Cookies are small text files that a website stores on your device. Ours are used only to make the site and the client portal work: to keep you signed in, to protect forms against misuse and to remember that you have read our risk notice. We do not use cookies for analytics, advertising or tracking across other websites, and we do not sell or share cookie data.
The cookies we set
All of the cookies below are set by this website (first party) and are strictly necessary for the service you are using. None is set until you do something that needs it.
| Cookie | Purpose | Lasts |
|---|---|---|
| helmsley_risk_notice | Remembers that you dismissed the Risk & Eligibility Notice shown on the public pages, so it is not shown again. | 1 year |
| connect.sid | Your session: keeps you signed in to the client portal or the admin area, and holds your progress through the registration process. | 24 hours, or until you sign out |
| __Host-csrf | Protects the sign-in and registration forms against requests forged by another site. | 4 hours |
| client_trusted_device, admin_trusted_device | Set only if you choose to trust a device when signing in, so a sign-in code is not asked for again on it. | 7 days |
| oauth_pending | Holds a sign-in that is in progress from the Helmsley app or a connected tool. | 10 minutes |
Third-party services
Google reCAPTCHA. The contact, borrowing, newsletter, brochure and registration forms are protected by Google reCAPTCHA, which tells us whether a submission looks automated. Google's script is loaded only when you start using one of these forms, and Google may set its own cookies and collect information about your browser and interaction with the form. This is governed by Google's privacy policy and terms of service.
OpenStreetMap. The map on our properties pages loads its map tiles from OpenStreetMap. Your browser requests those images directly, so OpenStreetMap sees your IP address; it does not set cookies. See the OpenStreetMap Foundation privacy policy.
No other third-party scripts, embeds or trackers run on this site.
Controlling cookies
Because every cookie we set is needed for the service you are using, we do not ask for consent to set them and there is no cookie-settings panel. You can block or delete cookies in your browser's settings; if you do, you will not be able to sign in, complete the forms or keep the risk notice dismissed. Deleting the helmsley_risk_notice cookie brings the notice back. For instructions for your browser see www.allaboutcookies.org.
Changes to this policy
We update this page when the cookies we set change. This policy was last reviewed in September 2026.