In most countries the law doesn't say you have to log everything about your users, but it does say that if you log it and the police ask for it then you have to give the data to them.
That's why companies that actually care about privacy (I think there are only two - Mullvad and Signal?) make a point of not ever capturing the data to begin with, and deleting what they do capture as soon as possible.
Interesting that you mention those two as I'd not trust either with private data. They engage in too much magical thinking in their marketing for my liking...
