I'd imagine their ToS which they can update whenever they want links to a privacy policy which they can update whenever they want, which is where this restriction is actually codified. The ToS probably also has another part saying they'll use your data "for business reasons including [innocuous use-cases]", and yet another part elsewhere which defines "business reasons" as "whatever we want including selling it".