Noob: If everything is public, how do I restrict access by clients?

Question

Lets say I want to create a protocol for storing user data for ecommerce stores.

If Walmart and Macy's sign up, how do I prevent Walmart from accessing Macy's user data when they do something like user.all ? Is there a way to scope it to just Walmart?

Perhaps if I created a ClientUser smart contract that Walmart and Macy's interact with directly and created a separate private / public key for each client, and each had a config for store_name: "Walmart" and store_name: "Macy" and had the ClientUser contracts talk to my DatabaseContract that would work? Not sure how I would store the users honestly.

Answer 1

If data stored in the blockchain needs to be hidden to certain parties and retrievable by other parties, the only option is to store it encrypted. The encryption and decryption should be done client-side (off-chain). The smart contract will not be able to decrypt the data.

Answer 2

You could have a public function the client can access that modifies data/returns data depending on the address calling it. The clients would then have their own addresses to interact with your contracts. Note that in this system, nothing is actually private because it's all on-chain.