More than a year after Facebook’s Cambridge Analytica scandal, Facebook-owned Instagram has banned one of its vetted advertising partners, HYP3R, after it was allegedly caught scraping a huge amount of data on users. The claim comes from Business Insider, which published a report last week alleging that HYP3R was saving Instagram Stories and harvesting posts from public location pages to track users.

HYP3R is a location-based marketing platform, according to the firm’s website. Business Insider claims it spoke to ‘multiple former’ HYP3R employees on the company’s practices in addition to reviewing public documents and marketing materials. Though the amount of data the company allegedly scraped from Instagram remains unclear, sources told BI that ‘more than 90%’ of the company’s data on ’hundreds of millions of the highest value consumers in the world’ came from the social media platform.

Among other things, the marketing company was accused of building a tool that enabled it to download and save Instagram Stories related to locations of interest.

An Instagram security issue that allowed users to view public location page posts without logging in made HYP3R’s alleged data harvesting possible, the report claims. Among other things, the marketing company was accused of building a tool that enabled it to download and save Instagram Stories related to locations of interest.

As a consequence of this alleged action, BI claims that HYP3R was able to ‘build up detailed profiles of huge numbers of people’s movements, their habits, and the businesses they frequent over time.’

Instagram reportedly sent HYP3R a cease-and-desist letter after learning about the marketing firm’s alleged actions, telling BI in a statement that the ‘actions were not sanctioned and violate our policies.’ In addition to removing the advertiser from its platform, Instagram said, ‘We’ve also made a product change that should help prevent other companies from scraping public location pages in this way.’