Hyp3r was scraping profiles, copying photos and siphoning off data supposed to be deleted after 24 hours, according to a Business Insider investigation.
Instagram said Hyp3r had "violated" its policies and had been sent legal papers telling it to stop collecting data.
Hyp3r said it complied with privacy regulations and the terms of service for the social networks it targeted.
Business Insider said Instagram's owner, Facebook, should have been more diligent about preventing data grabbing in the wake of the Cambridge Analytica scandal.
The investigation claimed Hyp3r had been "stitching" together data from one million Instagram posts a month, including Instagram Stories that were supposed to be deleted quickly, to build up profiles of millions of users.
And via these methods it had created detailed personal records that included photos, biographical data and information on users about where they lived, worked and travelled as well as what they were interested in.
In response to the investigation, Instagram said it had "removed" the company from its platform and rescinded its "Facebook Marketing Partner" status.
It said: "Hyper's actions were not sanctioned and violate our policies.
"We've also made a product change that should help prevent other companies from scraping public location pages in this way."
It emphasised the data Hyp3r grabbed was all public information.
Hyp3r boss Carlos Garcia also told Business Insider: "We do not view any content or information that cannot be accessed publicly by everyone online."
And he was confident Hyp3r could quickly resolve any issues with Instagram.
The BBC has contacted Hyp3r but the company has not yet responded to a request for comment.