Well they can see your browsing history, sure. But HTTPS will stop them from seeing the content you actually see on the web. At this point we are just getting into discussions of layers of trust, which are generally impossible to solve if you don’t trust anyone. If you don’t trust anyone don’t use the internet, ever. I do trust mullvad. They’re explicit about who is involved, I have the name of every team member, and through peer review I consider them trustworthy.

https://mullvad.net/en/about

For more info about how they are transparent, you can read their article about how they responded to a search warrant earlier this year:

https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/

In line with our policies such customer data did not exist. We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information.