Scholly Founder Sues Sallie Mae Over Student Data

A mission-driven exit turns into a privacy fight, exposing what founders miss when acquirers value user intent more than user trust.

Founder of Scholly sues Sallie Mae over student data sales, and the real story isn’t just privacy law. It’s the founder lesson underneath: selling a mission-driven startup to a giant does not mean your users get safer. Sometimes it just means the data plumbing gets harder to see.

Every founder has had this fantasy. Big strategic acquirer swoops in, loves your scrappy little company, keeps the mission intact, gives you distribution, compliance, resources, the whole sexy deck, and suddenly the thing you built while surviving on espresso and cortisol helps 10x more people.

Then reality shows up in legalese.

The headline Founder of Scholly sues Sallie Mae over student data sales sounds like one of those internet stories custom-built to make different tribes angry for different reasons. Founders see betrayal. Privacy people see surveillance. Finance people see litigation risk. I see something more familiar: the moment a founder realizes the acquisition pitch and the actual business model were speaking two different languages.

According to TechCrunch, Christopher Gray sold Scholly to Sallie Mae in 2023, joined as a vice president, expected to help scale the product and make it free, and is now suing in Delaware Superior Court while also filing an SEC whistleblower complaint. He alleges Sallie Mae used a nonbank subsidiary to monetize student data, including information tied to minors, and says he was fired about a year after the acquisition after raising privacy concerns.

I’m not saying every allegation is proven. I’m saying the shape of this story is painfully recognizable.

Because this is the founder nightmare nobody includes in the happy acquisition post. Not on LinkedIn. Not on X. Not in the all-hands where everyone claps and says “integration” like it’s a neutral word.

When startup scale means losing the plot

Chris Gray didn’t build Scholly so it could become some vague engagement asset inside a larger machine. He built it to help students find scholarships that were sitting there unused while college costs kept doing their usual American thing, which is to behave like a cartel with branding.

And Scholly had a real founder arc. Not fake startup Mad Libs. Gray got backing from Daymond John and Lori Greiner after appearing on Shark Tank. That matters because Scholly became more than an app. It became a public symbol of access, hustle, and upward mobility.

Gray also wasn’t just any founder taking an exit. TechCrunch noted he became one of the few Black venture-backed fintech founders to get acquired at all. When people accused him of selling out, he pushed back with a quote that hits differently now.

I think being one of the first Black tech companies to get acquired by a bank, that’s really a big achievement.

I felt that one in my chest a little. Because I get it. If you spend years building something mission-driven, and you’re carrying the extra symbolic weight of representation on top of normal founder stress, the acquisition doesn’t just feel like a payday. It feels like validation. Like the system finally said yes. Finalmente.

But founders and acquirers often mean completely different things when they say “strategic fit.” Founders hear mission amplification. Acquirers hear distribution, funnel control, audience ownership, monetizable intent. Those are not the same thing. Not even cousins.

Gray told TechCrunch he expected to help scale Scholly and make it free to use. That expectation makes perfect sense if you still believe the buyer values your product the way your users do. But if the buyer mostly values your audience and where they sit in the customer journey, then “scale” starts meaning something else. More reach for the machine. Not necessarily more protection for the people using it.

And when the machine is student finance, that difference is the whole story.

Founder of Scholly sues Sallie Mae over student data sales

Here’s where it gets very American in the worst possible way. Gray told TechCrunch that before agreeing to the sale, he believed Sallie Mae, as a federally regulated financial institution, would be restricted from disclosing or selling non-public personal information about Scholly customers to third parties.

That sounds reasonable if you’re a normal person.

It sounds less reasonable if you’ve spent enough time around corporate structures to know the brand says “one company” while the legal reality says “lol, absolutely not.” According to Sallie’s privacy policy, updated August 1, 2025, the policy covers SLM Education Services, LLC and explicitly says the following.

This Privacy Policy does not apply to Sallie Mae Bank’s collection and processing of your personal information.

That sentence is doing CrossFit.

Users think Sallie Mae is Sallie Mae. Founders often think that too. But legally, a parent brand can be a maze of entities, carveouts, notices, exceptions, and compliance hallways where accountability goes to die under fluorescent lighting. My nonna would call this a trick. A lawyer would call it structure.

The same privacy policy gets even more pointed under California law. It says SLM Education Services “sells” and “shares” categories of personal information including identifiers, internet or other electronic network activity, geolocation data, education records, and inferences drawn from personal information to create profiles.

That is not a tiny technicality. That’s the center of the case.

Gray’s allegation, per TechCrunch, is that a nonbank subsidiary monetized student data, including data tied to minors. That’s not just “ads are creepy” territory. That’s a trust problem at a different altitude, especially when the original product was a scholarship app meant to help students improve their future.

This is why the phrase Founder of Scholly sues Sallie Mae over student data sales matters beyond gossip. The issue isn’t just what the company did or didn’t do. It’s that the average user, and honestly a depressing number of founders, have no idea which entity actually governs the product, which entity holds the data, and which entity gets to turn “education services” into revenue.

Corporate structure is often where ethics go to hide.

If I’m selling my startup to an incumbent, I don’t just want the logo on the term sheet. I want to know which entity takes custody of the product, where the data sits, which privacy notice applies on day one, whether minors’ data is segregated, what can be shared for advertising or analytics, and what happens when someone in growth says, “we should activate this audience.”

If you don’t ask that, you’re buying a Vespa without checking whether it comes with wheels.

Scholly wasn’t just an app. It was premium intent data

Let me say the rude part out loud: scholarship search behavior is insanely valuable.

If someone is searching for scholarships, you can infer age range, education intent, household economics, academic stage, urgency, and the probability they’ll need financing later. That’s not just user activity. That’s predictive demand. It’s premium intent data with a wholesome wrapper.

Sallie Mae basically tells you where this sits. On its site, the company frames the business as Higher Education Solutions Tailored to You. That’s ecosystem language. Platform language. We’d-like-to-be-there-at-multiple-points-in-the-journey language.

And yes, the site also says the right thing on the surface.

We encourage students and families to start with savings, grants, scholarships, and federal student loans before considering a private student loan.

Fine. Good. That is the right order. I’m not mocking it. I’m saying you should notice how useful it is to own touchpoints at the top of that decision funnel.

If I’m there when a student starts with scholarships, I don’t just get to help. I get to observe. I get to classify. I get to build audience insights around what happens before the loan application. That’s commercially powerful whether or not anyone says the quiet part out loud.

Sallie’s own research on Gen Z scholarship behavior makes this even clearer. According to the company’s survey, 68% of Gen Z students used TikTok to search for scholarships at least occasionally. One in five searched on TikTok at least weekly. 60% discovered new scholarship opportunities there. And only 27% said they always verify TikTok scholarship info before applying.

That is a marketer’s dream and a trust-and-safety migraine.

Students are already looking for life-changing money in spaces optimized for velocity, vibes, and half-baked advice from somebody filming in a dorm room with LED lights behind them. If you run an education-services ecosystem, the value of capturing that demand early is enormous.

I’ve built consumer products. I know what “intent” feels like inside a dashboard. It’s intoxicating. You start with a mission. Then someone shows you cohort behavior, conversion paths, retention windows, cross-sell probability, and suddenly your saintly user base starts looking suspiciously like a funnel. Same human. Different spreadsheet.

That’s why I don’t buy the naive framing that Scholly was “just” a scholarship app inside a bigger company. No. In a business built around private student lending and broader education services, a scholarship-search product is top-of-funnel gold. Helpful to users? Sure. Also strategically rich? Dai. Obviously.

The post-acquisition red flag nobody wants to say out loud

The privacy allegations are the flashy part. The integration behavior is the tell.

According to TechCrunch’s review of Gray’s filings, he alleges Sallie Mae laid off Scholly employees, including his co-founders, after the acquisition. That detail made me pause longer than the legal language did, because I’ve seen this movie before and the ending is always the same. Once the people who carry the product’s values and user intuition are gone, the mission survives mostly as a slide.

Your title can still say vice president. Cute. Your email signature can have the new logo. Mazel tov. But if your team is gone and the incentives changed, you are not really operating the thing anymore. You’re the mascot for a strategy someone else controls.

Gray says Sallie Mae later fired him about a year after the acquisition after he raised concerns about data privacy issues. He’s suing for backpay, punitive damages, and legal costs. Those are allegations. But even before a court decides anything, the pattern should make founders sweat a little.

Because the minute an acquirer strips out the people who know why users trusted the product in the first place, the center of gravity shifts. Fast.

I learned a milder version of this the ugly way. Years ago, after selling a tiny product line inside a broader software deal, I stayed on to help with transition. Very noble. Very founder-brain. Within months, support scripts changed, roadmap priorities shifted, and users who loved the original thing started getting nudged into products they never asked for. Nobody technically lied to me. Which was somehow worse.

That’s why I think the post-exit founder role is often theater. If your co-founders are out, your team is cut, and the parent company’s incentives live somewhere else, your power is mostly symbolic. You sold the company and then discovered you didn’t really sell on your terms at all.

Scholly founder stands confidently in front of a Sallie Mae office, highlighting the student data lawsuit.

Wall Street loves adjacent services until trust breaks

The timing here matters. This lawsuit is landing while Sallie Mae is telling investors a very clean story about performance, capital returns, and category leadership.

In its January 2026 earnings release, Sallie Mae announced a new $500 million share repurchase program. The earlier 2024 share repurchase program still had $650 million authorized and open. That’s real money. The kind of announcement meant to tell Wall Street, “Relax, the adults are in charge.”

The company also describes itself in investor language as the leader in private student lending while offering education-related services. In its 2025 Form 10-K, it says it operates as a single reportable segment that originates and services private education loans while providing other education-related services.

That “other” is doing a lot of work too.

Because “adjacent education services” sounds harmless in earnings materials. Sensible. Diversified. Maybe some calculators, content, scholarship tools, planning resources, niente di che. But adjacent services can also be where incentive conflicts hide, especially when the adjacent service captures trust and behavior upstream of the core money-maker.

If I’m an investor, I don’t just care whether a privacy lawsuit creates legal exposure. I care whether the broader strategy depends on operating in the gap between what users think they signed up for and what the company is actually allowed to do. That gap is where reputational risk compounds.

You can buy back stock. You cannot buy back trust with the same efficiency.

And student-facing products are more fragile than executives like to admit. Students are younger. Families are stressed. Information asymmetry is already brutal. Add opaque data practices, or even the perception of them, and the whole “we help you make smart education decisions” promise starts wobbling.

A lot of companies learn this too late. They think users are sticky because the product is useful. Then they find out users were loyal because the product felt aligned with their interests. Once that alignment cracks, your “adjacent service” starts looking less like support and more like extraction wearing a cardigan.

The founder question that matters after the lawsuit

This is the operator lesson for anyone reading about Founder of Scholly sues Sallie Mae over student data sales and thinking “damn, messy.” It is messy. But it’s also basic. Too many founders still act like diligence ends with price, structure, and retention packages. Amateur hour.

If your startup serves students, patients, creators, workers, kids, anyone trying to improve their life from a structurally weaker position, then the acquirer’s data architecture is part of the deal. Full stop.

Ask who owns the data at the entity level after close. Ask which privacy policy governs the product on day one and after integration. Ask whether the product can be folded into a broader marketing layer. Ask for written commitments around policy changes. Ask what categories of personal information can be sold or shared. Ask how minors’ data is handled. Ask which team members must be retained, for how long, and with what authority.

And if the buyer gets twitchy when you ask, bene. That’s information.

One detail from the SEC filings says a lot. Exhibit 21.1 to SLM’s annual report lists Sallie Mae Bank as a named significant subsidiary and notes that other subsidiaries are omitted because they are not individually significant. That’s normal SEC practice. But from a founder’s perspective, it also means the public picture of group structure is often incomplete exactly where the important questions begin.

Gray didn’t just file a lawsuit. He also filed an SEC whistleblower complaint. And the minors issue raises the stakes beyond generic privacy squishiness. We’re not talking about adults browsing sneakers and getting haunted by loafers for three weeks. We’re talking about students, some of them minors, using a product framed around opportunity and access.

If the only thing protecting those users after the acquisition is goodwill and a founder hoping the buyer shares the mission, then congrats, you did not sell a company. You outsourced your conscience.

Harsh? Yes. Also true.

I’m not saying founders should never sell to incumbents. Sometimes a strategic buyer really can bring scale, lower costs, broader distribution, and better compliance. Sometimes the fairy tale is half true. But “regulated incumbent” is not a synonym for “safer for users.” Sometimes it just means the organization is better at slicing activities across entities, policies, and disclosures in ways normal people will never understand.

The old founder question was: what’s my multiple?

The adult question is: what happens to the people who trusted my product when I’m no longer the one making the call?

That should be a board question. A legal question. A moral question. And yes, a pricing question too.

Because if your users are the reason the company has value, then their treatment after close is not some soft issue for the comms team. It’s part of the asset. If the acquirer wants the trust your product earned, that trust should be contractually protected, not just name-dropped in a press release.

I think this story is going to age badly for more than one company. Not because every allegation will be proven exactly as filed, but because it exposes a founder delusion a lot of us have entertained at one point or another: that mission survives acquisition by default.

It doesn’t.

So here’s the question I’d leave hanging over an overpriced aperitivo: when founders say they got a great outcome, great for whom exactly — the cap table, or the people who trusted the product before it became a funnel?