Yes, the VPN provider could easily see the data you're sending over the VPN connection should they so choose to.
There are some steps you could take to at least see if the VPN service is requiring you to send all recursive lookups (DNS requests) for your web traffic through the tunnel or not. If you're on a windows host, you can do one of the following from an elevated command prompt:
netsh interface ip show route
or route print
These will show you your routing tables on your local machine. When you connect to a VPN, the VPN will inject routes into your routing table for the VPN to work properly. Look for your wildcard route(s). They look like 0.0.0.0
. These are there to direct all of your DNS lookups (which are used when requesting address information for an FQDN or domain name if you prefer) and if you have one pointing to an IP address listed other than your router or home IP router, then they are likely forwarding all of your DNS traffic through the VPN. In this case, they could theoretically see just about everything you're doing on the Internet.
As far as the potential malicious intent of the VPN provider, that's up for you to decide. The idea behind connecting to a VPN is to keep the badies out, not provide a direct connection to them.