US is a contender as long as you're willing to fight the US government in court, and you'd likely have to. The law may ultimately be on your side, but that doesn't mean the US government won't try to drop the hammer hard on you if they really want your data. They know most of the small companies and even some of the big ones scare easily, so the aggressive attitude is well worth it for them, even if they know they're doing unconstitutional data requests.

Switzerland and Germany are probably the best right now, although Switzerland recently passed a surveillance law, too, but I'm not sure how it affects VPNs. Germany has a privacy-friendly Constitution and resides within the EU, which also has strong privacy laws. However, Germany is also trying to limit privacy rights, so this may be a little unpredictable right now. Germans usually tend to care more about privacy so they may fight this, though.

https://www.theguardian.com/world/2016/sep/25/switzerland-vo...

http://www.dw.com/en/germany-planning-to-massively-limit-pri...

More than anything I would recommend a "zero-knowledge" approach, so use the strongest and most ephemeral VPN encryption and generally try to discard user-related data as soon as you get it. And put it all in your ToS/Privacy Policy so that it's legally harder to lie to your customers when you're forced to not do that anymore.