Their privacy policy lets them sell individual messages as long as they're scrubbed of "personal information." Where their bar is for that is anyone's guess.
If all they wanted to do was collect and sell aggregate data, you'd think they would say so, and would have reiterated it in their "apology." If they actually gave a shit about their users' personal data, they'd make sure their privacy policy was as restrictive (for the company) as possible while still permitting them to operate.