In Sweden (where Mullvad has its origin) IPSs are forced to keep data on its users, see Datalagringsdirektivet. It does not apply to VPN providers.