Faster alternatives to RSA trapdoor permutation
encrypt with the private key, and decrypt with the public key

That statement, and the very name privateEncrypt, is incompatible with standard terminology: &quot;public&quot; means known to all and opposes to &quot;private&quot;; and &quot;encrypt&quot; implies transforming some information $X$ into $Y$ in a way such that if $Y$ becomes public, $X$ does not.
Per standard terminology we sign with total message recovery, and recover the message. The term &quot;total message recovery&quot; designates a signature scheme where all the data is conveyed in the signature itself. This is how RSA signature was introduced, and the term is used in the ISO/IEC 9796 series of standards.

RSA in pure mode is extremely slow

Whatever the name and the variants, RSASign is indeed rather slow, and usually size-expanding. This can be mitigated, but some slowness will remain.
On the other hand, RSARecover is relatively fast, and Integer Factorization (based) Crypto (the IFC family, which best known member is RSA) is by far the fastest asymmetric crypto around for the task. In the application, if information retrieval quantitatively dominates, that might be an advantage.

Are there any other similar cryptographic functions we can use for this case, which are superior to the RSA scheme in speed and size?

Outside of systems closely related to RSA in that they belong to IFC, none that I have met since I started watching public key crypto¹.
Let's see how we can mitigate the issues:

RSASign can be made faster by

Using a right-sized public modulus (and correspondingly splitting the information into blocks²). Currently the accepted minimum for signature is $n=2048$-bit public modulus, and all things being equal the signature cost per byte grows only slightly slower than $n^2$.
Using the Chinese Remainder Theorem method. Every speed-optimized implementation of RSA signature does that, because it reduces computational cost by a factor typically over three. Some implementations also use it to spread most of the workload on several CPU cores, further reducing encryption time. Implementations of RSA encryption can not use that method, because it requires the private key.
Using a public modulus product of $k&gt;2$ primes. That's known as multiprime RSA. All things being equal, execution time is roughly halved when we go to 3 primes, divided by more than three with 4 primes. If high security assurance is not paramount, it would be reasonable to consider $(n,k)=(2048,4)$.
Using highly optimized implementation. Shay Gueron and Vlad Krasnov's Speed Records for Multi-prime RSA Using AVX2 Architectures (in CIT 2016) report $(1.9,\,1.0,\,0.6)$ million Skylake CPU cycles/signature for $n=2048$, $k=(2,\,3,\,4)$, translating to $(0.4,\,0.7,\,1.3)$MByte/s/core @3GHz (neglecting time and size overhead due to padding). And then dedicated hardware is a possibility.


Size overhead depends on padding:

If we want to use something standardized and cut no corner, we can use ISO/IEC 9796-2 scheme 2 and a random nonce as wide as the hash size. The size overhead is $3h/2+16$ bits out of $n$, that is 206 bytes stored in a 256-byte cryptogram with SHA-256 and $n=2048$ (+24.3% overhead). Even if the data actually stored was entirely constant, it's unlikely two stored blocks would get identical until there are $2^{64}$, that is &gt;3ZiB effective data.
If we accept something custom, a deterministic transformation (which allows to store a single copy of identical data blocks), and dropping cryptographic signing, the size overhead can be one bit per block (just apply a reversible transformation to the data followed by textbook RSA signature, that is textbook RSA encryption), or even zero (apply textbook RSA only to values lower than the public modulus after the reversible transformation, and generate the public/private key pair so that the high-order 64 bits of the public modulus are all-one).


RSARecover can be made faster by

Using a low public exponent, such as $e=3$. This allows the exponentiation to use one modular squaring and one modular multiplication, rather than sixteen and one for the most common $e=65537$. Except for possible regulatory requirements, $e=3$ is fine. There's a saving by a factor of roughly 8, and now RSARecover typically is hundreds of times faster than RSASign (when $k=2$). We are talking some gigabit/s on a standard PC.
Using $e=2$, which allows a further saving by some factor like two. The name changes from RSA to Rabin signature, there are a few minor complications, but that remains fully academic and covered in ISO/IEC 9796-2.




¹ That was in 1980 during one of these strikes France is renewed for. My math (Spé) teacher dropped the official program and showed her class RSA, based on Martin Gardner's article.
² As pointed in comment, if we only do that splitting, we loose overall message integrity assurance (an adversary can swap signed blocks). I don't see that such assurance is indispensable in the context. But if we require it, we can prepend a fixed-width block number to a block's payload, at the expense of increased size overhead. A note suggests &quot;Using CBC rather than ECB&quot; but that does not seem to work unless the data signed is somewhat redundant.