I wonder how hard is it to change their policy? Suppose some day the investors insist on monetizing this asset to its maximum potential. Can they just come up with a new privacy statement?

In order to stop them from doing that their change would have to be a clear criminal violation of something. Nobody would be able to sue them, and even getting them in a clear criminal violation would be tough (in the US anyway; recall the debacle of v. Microsoft).