Instagram has banned one of its owner Facebook’s official marketing partners, San Francisco-based HYP3R, after “a combination of configuration errors and lax oversight” on its behalf allowed HYP3R to scrape massive amounts of data on Instagram users, Business Insider reported on Wednesday.

HYP3R, which has raised tens of millions of dollars in funding, relies on tracking social-media posts tagged in real-world locations, then allowing its marketing clients to interact with the users who uploaded them (say, to address complaints about service) or use that data for targeted advertising purposes.

But following the fallout of the Cambridge Analytica data-harvesting scandal at Facebook in early 2018, Instagram began disabling some parts of its API—including location tools.

According to Business Insider, while HYP3R publicly supported the decision, it also created tools meant to continue scraping that data in ways that took advantage of Instagram’s sloppy implementation of the API rollbacks and sure look like violations of its terms of service.

Using that access, the company created geofenced locations ranging from stadiums to hotels, harvested “every public post tagged with that location on Instagram,” and stored them indefinitely.

It also built a tool to download Instagram Stories, which are supposed to auto-delete after 24 hours, from those locations and similarly store them forever.