NordVPN certainly has a lot of positive things going for it. My only real issue with them is that they were hacked back in March 2018, and it took them 18 months to tell their users that their data might have been compromised or their traffic decrypted by a malicious third party. It's difficult to trust a company who don't tell their users when there are security issues.
Tunnelbear's privacy policy isn't terrible, but they do keep some logs including details about your OS, your app version, and how much data you use. They are based in Canada (five eyes country), and are owned and operated by McAfee. Their free plan only allows 500MB a month, and the only way to pay for a plan is via a credit card, which obviously then links your VPN activity to your real name and address, which is far from ideal. Overall, not a great choice.
Avast's privacy policy is awful:
Data collected directly from you or your device relating to an identified or identifiable natural person (“Data Subject”), and may include direct identifiers such as name, address, email address, phone number, and online or indirect identifiers such as login account number, login password, marketing preferences, social media account, payment card number, or IP address;
We may use contractors and service providers to process your Personal Data for the purposes described in this Privacy Policy and Products Policy . We contractually require service providers to keep data secure and confidential.
Such service providers may include in particular contact centers, professional consultants (including for defence or exercise of our rights), and marketing/survey/analytics/software suppliers.
Sometimes these service providers, for example, our distributors, resellers, and app store partners, will be independent controllers of your data and their terms and conditions, end user license agreements (“EULA”) and privacy statements will apply to such relationships.
Avast collects your personal data including real name, address, social media accounts, and IP addresses, and shares that data with marketing, surveying, and data analysis companies. Avoid them at all costs.