I remember a little while back when the British museum was making headlines about the return of stolen artifacts, I was initially really surprised and pleased that they were making progress towards repatriating some of their collection.
Then I actually read the article and it turned out some artifacts had been stolen from the museum and they wanted them back. :l
I've been using mullvad for a few years—since PIA got bought out—and would recommend it if you're concerned about trust.
So, using a VPN doesn't actually eliminate all possibility of being tracked. All you're doing is replacing who can potentially see all of your data, from your ISP to the VPN provider, so trust is actually a pretty important factor.
When I switched the consensus at the time was that mullvad was the most true to its privacy statement, i.e. trustworthy. A lot of other vpns are cheaper or have more bells and whistles, but have histories of data breaches or scandals, are based in countries with weak privacy/strong surveillance laws, or are owned by companies that may have an interest in the customers data (like with the PIA acquisition I mentioned).
Mullvad too has had a few incidents where they were served court orders to provide data to the police, but iirc no data was ever actually given up. Plus, they allow a bunch of different privacy-centric payment methods, including just sending cash in an envelope.
I'd recommend taking a look at some more recent discussions comparing VPNs but I think considering mullvad is a good place to start.