From your link : "we randomly sample a small subset for permanent storage." Even if anonymous that data is really valuable as it allows to identify traffic patterns. I don't see anything "evil" in collecting anonymized data.

I wonder how hard is it to change their policy? Suppose some day the investors insist on monetizing this asset to its maximum potential. Can they just come up with a new privacy statement?

In order to stop them from doing that their change would have to be a clear criminal violation of something. Nobody would be able to sue them, and even getting them in a clear criminal violation would be tough (in the US anyway; recall the debacle of v. Microsoft).