A security researcher has been awarded a bug bounty after discovering Instagram was retaining data long after he had deleted it.