VPNs protect your privacy, but who can still access your data? And what information can they actually see?